Re: Why everyone uses envelopes but few encrypt emails?


privacy concerned wrote:

Except that the MITM now has impersonated you and has taken your secret
message as well. Knowing this after the fact is way too late.

The fact that the recipient can find out that the message has been
spied upon is a deterance for spies. This is similar to an envelope -
you only know that someone has opened the envelope on your letter after
the fact.

No, it's a deterant for the system. If I'm mailing an SSH password
through this, great I can find out if the recipient got it or not, but
only after they say "hey wait my email won't open". At that point the
MITM attacker has already logged on to the box and stole your secrets
[or did damage].

Fundamentally you're still stuck with the "how do we exchange keys in
the first place" a problem which has plagued PGP for years.

The fact that this is all nicely centrally organized on your servers
doesn't speak well for the scheme either. We have to trust that you
can maintain privacy.

Also what of authenticity? You haven't spoken two words about that.

Tom

.

Relevant Pages